The Control Web Panel (CWP) vulnerability allows an unauthenticated attacker to deliver a malicious "key" parameter to the /admin/index.php endpoint when the "api" setting is active. Because the input is passed directly to the operating system without sanitization, it is a classic command‑injection flaw (CWE‑78). The script runs with root privileges, meaning the attacker can execute arbitrary commands, seize full control of the server, and compromise confidentiality, integrity, and availability. Based on the description, it is inferred that the attacker must be able to send a web request to /admin/index.php while the "api" parameter is enabled.

All installations of Control Web Panel prior to version 0.9.8.1209 are affected. The flaw requires that the administrative API is exposed and that Softaculous or SitePad components are present on the host.

The CVSS score of 7.3 reflects a high severity impact. An EPSS score of 4% indicates a low probability of exploitation today, but the required prerequisites—public access to the API and the presence of Softaculous or SitePad—create a clear attack vector. The vulnerability is not in the CISA KEV catalog, yet its root‑level impact justifies urgent attention.